According to [W3C](https://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#the-setrequestheader()-method), following headers are reserved and can't be explicitly set by JS: - header name starting with `Proxy-` or `Sec-` - Accept-Charset - Accept-Encoding - Access-Control-Request-Headers - Access-Control-Request-Method - Connection - Content-Length - Cookie - Cookie2 - Date - DNT - Expect - Host - Keep-Alive - Origin - Referer - TE - Trailer - Transfer-Encoding - Upgrade - User-Agent - Via So if a blueprint spec has mentioned one of the above headers, Drakov should ideally ignore that in it's url matching algorithm.